46

By chance I noticed a weird rendering of the diamond-operator tag search info box:

enter image description here

Clearly () is not the diamond operator, so let's click improve tag info and see what's up with that. As we can see the tag wiki title actually contains the <>, so I assumed some escape mechanics to be at fault here. I suggested an edit to introduce escaping backslashes to the angled brackets in the title, only to see that these are rendered in the title and don't seem to actually escape anything. I dun goofed :(

While the pending edit was awaiting approval I happened to hover the tag pill and noticed that the brackets are rendered there just fine:

enter image description here

So my pending edit would screw that view over too. Sadly it was actually accepted and applied, so I had to submit another edit suggestion effectively reverting what damage I had done.

Interestingly, my 'all actions' history preview shows yet another escaping behaviour, where the first backslash would render but the second mysteriously vanishes:

enter image description here

The excerpt review history of the tag itself on the other hand shows everything perfectly fine:

enter image description here

So now we have 4 different views presenting 4 different behaviours in regard to the escaping mechanisms. I am confused at least.

Update: 6-months-later update - this issue still persists.

7
  • 2
    &lt; & &gt; === < & > Now whether that stands true in the tag wiki views or not, remains to be seen.
    – user4639281
    Commented Oct 7, 2015 at 20:02
  • 3
    By the way, in the revision history, you're looking at the markdown view, which shows what was actually typed. Granted, upon looking at it, it does appear to show properly in side-by-side mode as well, it's just that your screenshot shows markdown.
    – Kendra
    Commented Oct 7, 2015 at 20:15
  • @Kendra good catch, I didn't even see those buttons! The side-by-side view indeed shows the same faulty rendering behaviour as the action history.
    – kasoban
    Commented Oct 7, 2015 at 20:20
  • 14
    This is a sad story :( Commented Oct 8, 2015 at 15:26
  • 7
    Why for the love of all that is holy does a site dedicated to programming default to stripping anything that looks vaguely like HTML, rather than just automatically escaping it using HTML entities!?
    – IMSoP
    Commented Oct 8, 2015 at 20:56
  • 3
    @Blackhole No, the Markdown parser Stack Overflow uses explicitly strips un-whitelisted tags rather than escaping them. The fact that <i> is allowed is no reason for <foo> not to be escaped, and it just leads to XML and HTML questions from new users being completely useless until you edit them.
    – IMSoP
    Commented Oct 9, 2015 at 11:22
  • I think this will fall into infinite recursion. Edit to add escaping backslashes and then edit to remove and then edit to add and then ... SO please fix this ASAP Commented Oct 9, 2015 at 14:48

1 Answer 1

5

This should be fixed now! We were doing some extra sanitizing where it wasn't needed.

1
  • Ha, at long last! :D Quick check looks good so far
    – kasoban
    Commented Jan 10, 2019 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .